Skip to contentSkip to conversation

iptables-xml

PATCH Applied Amin Azez 2 participants 3 messages Jul 16, 2007 – Jul 17, 2007 1 message not in the archive netfilter

lore
Share & tools
lore

Amin Azez

author
#0 lore raw

PATCH 1/1 iptables-xml

Attached are:
1. A man page for iptables-xml

2. A fix for iptables.xslt allowing for an arbitrary depth of arguments or modifiers.

Although iptables-xml cannot generate more than two levels deep, xml generated by other systems may prefer to generate

<action>
<restore-mark>

    <mask>0xff00</mask>

</restore-mark>
</action>

than

<action>
<restore-mark/>
<mask>0xff00</mask>
</action>

(which is what iptables-xml generates)
even though the same iptables is re-generated on conversion.

3. A fix for iptables-xml.c so that combining of consecutive targets of rules with the same match into one XML rule, will not combine over a terminating action; i.e. there is no point in converting

-A table -p tcp -j DROP
-A table -p tcp -j MARK --set-mark 25
-A table -p tcp -j RETURN

into one XML rule with multiple actions as they are probably not logically combined in the mind of the author.

Signed-off by: Sam Liddicott <[email protected]>

exbanderutils/xslt/iptables.xslt renamed from tmp/iptables.xslt?rev=6695 +3 -2
@@ -44,7 +44,7 @@
   </xsl:template>
   
   <!-- all child action nodes -->
-  <xsl:template match="iptables-rules/table/chain/rule/actions/*/*|iptables-rules/table/chain/rule/actions/*//*|iptables-rules/table/chain/rule/conditions/*/*|iptables-rules/table/chain/rule/conditions/*//*">
+  <xsl:template match="iptables-rules/table/chain/rule/actions//*|iptables-rules/table/chain/rule/conditions//*" priority="0">
     <xsl:if test="@invert=1"><xsl:text> !</xsl:text></xsl:if>
     <xsl:text> -</xsl:text>
     <!-- if length of name is 1 character, then only do 1 - not 2 -->

@@ -52,7 +52,8 @@
       <xsl:text>-</xsl:text>
     </xsl:if>
     <xsl:value-of select="name()"/>
-    <xsl:text> </xsl:text><xsl:value-of select="."/>
+    <xsl:text> </xsl:text>
+    <xsl:apply-templates select="node()"/>
   </xsl:template>
 
   <xsl:template match="iptables-rules/table/chain/rule/actions/call/*|iptables-rules/table/chain/rule/actions/goto/*">
iptables-xml.8 new file +89 -0

89 lines not on this page · raw message

iptables-xml.c renamed from tmp/iptables-xml.c +25 -1
@@ -359,6 +358,18 @@
 		    || strcmp((arg), "--goto") == 0));
 }
 
+// is it a terminating target like -j ACCEPT, etc
+// (or I guess -j SNAT in nat table, but we don't check for that yet
+static int
+isTerminatingTarget(char *arg)
+{
+	return ((arg)
+		&& (strcmp((arg), "ACCEPT") == 0
+		    || strcmp((arg), "DROP") == 0
+		    || strcmp((arg), "QUEUE") == 0
+		    || strcmp((arg), "RETURN") == 0));
+}
+
 // part=-1 means do conditions, part=1 means do rules, part=0 means do both
 static void
 do_rule_part(char *leveltag1, char *leveltag2, int part, int argc,

@@ -536,7 +547,19 @@
 
 	while (new < newargc && old < oldargc) {
 		if (isTarget(oldargv[old]) && isTarget(newargv[new])) {
-			compare = 1;
+			/* if oldarg was a terminating action then it makes no sense
+			 * to combine further actions into the same xml */
+			if (((strcmp((oldargv[old]), "-j") == 0 
+					|| strcmp((oldargv[old]), "--jump") == 0) 
+				&& old+1 < oldargc
+				&& isTerminatingTarget(oldargv[old+1]) )
+			    || strcmp((oldargv[old]), "-g") == 0 
+			    || strcmp((oldargv[old]), "--goto") == 0 ) {
+				/* Previous rule had terminating action */	
+				compare = 0;
+			} else {
+				compare = 1;
+			}
 			break;
 		}
 		// break when old!=new
#1 lore raw
Quoted 33 lines · Amin Azez

Attached are:
1. A man page for iptables-xml

2. A fix for iptables.xslt allowing for an arbitrary depth of arguments or modifiers.

Although iptables-xml cannot generate more than two levels deep, xml generated by other systems may prefer to generate

<action>
<restore-mark>

    <mask>0xff00</mask>

</restore-mark>
</action>

than

<action>
<restore-mark/>
<mask>0xff00</mask>
</action>

(which is what iptables-xml generates)
even though the same iptables is re-generated on conversion.

3. A fix for iptables-xml.c so that combining of consecutive targets of rules with the same match into one XML rule, will not combine over a terminating action; i.e. there is no point in converting

(quoted diff) +0 -3
-A table -p tcp -j DROP
-A table -p tcp -j MARK --set-mark 25
-A table -p tcp -j RETURN
Quoted 2 lines

into one XML rule with multiple actions as they are probably not logically combined in the mind of the author.

I assume these changes are compatible with previous versions?

A message that is not in the archive (sent off-list or not yet received): [email protected]

Applied
#3 lore raw
Quoted 11 lines · Amin Azez

* Patrick McHardy wrote, On 17/07/07 16:10:

Quoted 2 lines

I assume these changes are compatible with previous versions?

Yes, although (3) indicates a change in behaviour,
a. nothing here will prevent previously generated xml from forming the same iptables rules.
b. although slightly different xml may be generated (due to different target combining with the -c switch), the new or old xslt will still generate the same iptables rules from the new xml.

OK, I trust you know what you're doing (when it comes to XML, I certainly don't :))

Applied.